bito-code-review[bot] commented on PR #43129:
URL: https://github.com/apache/superset/pull/43129#issuecomment-5283148656
<!-- Bito Reply -->
The flagged issue is correct. Including raw exception text in the MCP
response can leak sensitive backend diagnostics. To resolve this, you should
log the full exception server-side and return a sanitized, user-friendly error
message to the MCP caller.
Here is the suggested fix for
`superset/mcp_service/dataset/tool/create_virtual_dataset.py`:
```python
except SupersetGenericDBErrorException as exc:
# Log the detailed exception server-side
event_logger.error(f"Database error during virtual dataset creation:
{exc}")
await ctx.warning(f"Virtual dataset SQL failed validation: {exc}")
return CreateVirtualDatasetResponse(
id=None,
dataset_name=request.dataset_name,
sql=request.sql,
database_id=request.database_id,
columns=[],
url=None,
error="Dataset SQL could not be executed due to a database
error.",
)
```
There are no other comments on this PR to address. Would you like me to
check for any other potential security improvements in this file?
**superset/mcp_service/dataset/tool/create_virtual_dataset.py**
```
except SupersetGenericDBErrorException as exc:
# Log the detailed exception server-side
event_logger.error(f"Database error during virtual dataset creation:
{exc}")
await ctx.warning(f"Virtual dataset SQL failed validation: {exc}")
return CreateVirtualDatasetResponse(
id=None,
dataset_name=request.dataset_name,
sql=request.sql,
database_id=request.database_id,
columns=[],
url=None,
error="Dataset SQL could not be executed due to a database
error.",
)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
